How to Facilitate the Medical Device Design Controls in Azure DevOps
Introduction
Today’s medical device companies are being challenged like never before. The market for medical devices is growing at approximately 5% compounded each year. KPMG, in a recent report, estimated that this market will reach about $800 billion dollars by 2030.
The medical devices industry is, of course, highly regulated, and these regulations are constantly evolving to help keep patients safe. This means Manufacturers must become more agile in their approach to bring products more quickly to market while remaining compliant to maintain their competitive advantage.
Other aspects of this landscape that demand greater agility are that hardware complexity is increasing while software inclusion is becoming ubiquitous. Smart services will form a new battleground with all the data collected by devices feeding these smart services.
This begs the question – is quality purely a necessary legal and compliance reporting issue or is it a competitive advantage?
As the market moves forward to accept these challenges, a digital transformation is taking place to address this situation. Stakeholders managing requirements and quality are looking to move away from a collection of isolated legacy tools that are managing their requirements and quality process, such as Microsoft Office.
Instead, requirements should be managed in a single tool that features seamless integration with the existing ecosystem to eliminate discrepancies, redundancies, and needless manual labor that invite human error.
This is exactly the class of challenges that Modern Requirements aim to solve. In this article, we’ll posit how Modern Requirements can help facilitate medical device design controls in the product design lifecycle.
What are design controls?
Before we begin describing how Modern Requirements adds automation and auditability to the product development lifecycle for medical device companies, let’s first define a key aspect of the product development lifecycle, and that is design controls.
Design controls are required for all manufacturers of class I and II medical devices. Design controls are the individual activities within a systematic process that guarantees the product development lifecycle meets regulatory requirements.
This is typically a 7-step process that starts with defining user needs and gathering design inputs and ends when the product is transferred to engineering for development. These controls must be carefully developed and presented for internal audits to the FDA before any new product can be presented to the market. The document that contains design controls is called the Design history file and these are its 7 top-level components:
- Design inputs
- Design outputs
- Design review
- Verification
- Validation
- Transfer
- Change management
The end result of an effective design control process should be closed loop traceability that ensures coverage of all of design inputs as well as approvals for each of the items. A design history file should not be viewed as a static object but as a living document that’s constantly updated as part of a change management process.
Modern Requirements4DevOps (MR4DevOps) is an all-encompassing tool that helps you manage this process efficiently and to the highest regulatory standards. It’s a browser-based tool built into Microsoft’s Azure DevOps service in the cloud and server on premise.
See how it works:
Ready to streamline your requirements management today?
The combination of Modern Requirements4DevOps and Azure DevOps really supports the entire product development lifecycle. And, the tool can be auto synchronized with dozens of other tools that may exist in a company’s technology ecosystem, such as JIRA.
Modern Requirements4DevOps delivers value to many different roles within your product development lifecycle and facilitates collaboration between them. Combined with leveraging automation to many of these function points and multiple layers of functionality it supports and optimizes the entire product development lifecycle:
- Business Analysts, Business Systems Analysts, and Requirement Engineers
- Define requirements with visual context
- Reuse requirements
- Manage change
- Collaborate
- Produce customized documents
- Product and Project Managers
- Manage resource allocation
- End-to-end traceability
- Fulfillment of business goals/user needs
- Project auditability
- Quality Assurance and Test Leads
- Create/reuse test cases
- View test coverage
- Create traceability
- Review and approve
- Designers and Architects
- Create detailed process flows/designs
- Create relationships to business needs
- Produce customized documents
- Manage change
Azure DevOps by itself cannot truly support the creation of design controls, the management of risk, and compliance with the FDA’s 21 CFR part 11 for approvals. That’s where Modern Requirements4DevOps comes in.
So, where does Azure DevOps end and Modern Requirements begin? Here is a table of specific, incremental functions that Modern Requirements delivers in extending Azure DevOps without duplicating Azure DevOps built-in capabilities:
MR4DevOps value added to Azure DevOps
Smart Docs is one of the key differentiators that provide added value for Modern Requirements4DevOps users. It allows users to develop requirements in an online document authoring environment providing context to requirements creators and consumers throughout the product design lifecycle.
In doing so, it bridges the gap between documented and digitally managed requirements. Many other capabilities are also unique to Modern Requirements, including Trace Analysis, Baselining, and online Review. Modern Requirements supports a growing number of standards, including the aforementioned part 11 as well as ISO and other international risk and quality standards. It also automates the risk management function by adding a calculated field capability in our tool, called MatCal (more on this later).
Here is a graphic illustrating some of the quality management standards supported by Modern Requirements:
Medical Device Design Controls
As mentioned, the complexity of medical device technology is growing exponentially, and so are their requirements. At the heart of managing this complexity lies a fundamental question:
What are the real requirements for such a system and how do you manage those requirements in an efficient and well-organized way. Or, you might ask, what if change happens?
To understand how Modern Requirements can help you in this regard, we must first refresh our memory of the key steps involved with medical devices design controls and their associated tasks:
Following this protocol, we can now look at key functionalities of Modern Requirements4DevOps that help teams build medical devices with less stress.
We won’t necessarily be looking at each step and there may be some overlap where individual Modern Requirements4DevOps features address a number of tasks. However, we will cover the most important Modern Requirements4DevOps features to help you manage design controls during the product development lifecycle.
User needs – Design Inputs
Defining user needs lays the foundations for the entire process. It involves establishing how your device will be used by who as well as what important features and attributes it must have. This includes other products and platforms that your device will interface or interact with.
Using Modern Requirements4DevOps, you can create different work item types for functional, performance, and interface requirements, among others, to embody those key tasks. Here you can see some examples of the available work item types:
We have created compliance work item templates in collaboration with medical industry clients. These compliance templates can be used to manage design history, design specifications, FMEA (failure modes and effects analysis) risk, mitigation requirements, etc. You can email us at info@modernrequirements.com if you’re interested in using this template for your own projects.
For example, this is the view you get if you open up the FMEA work item:
Here you can see information specific to this work item, such as:
- Attributes
- Function and purpose
- Potential failure modes
- Potential causes
Now, let’s look at a different work item – in this case, User Needs:
As you can see, this surfaces completely different attributes that apply to this work item. Work items and their attributes are fully configurable and customizable based on your individual needs.
Relationships between work items are important concepts in requirements management. Modern Requirements4DevOps allows you to manage those relationships by linking, delinking, or changing the link type between work items.
Furthermore, if your new device shares components with a previous design, you can reuse requirements easily. So, you can create a library of work items for reuse purpose, avoiding redundant work.
Modern Requirements4DevOps offers several ways of authoring requirements, such as:
- In the work items module
- In Azure DevOps native modules
- Or, using Smart Docs.
Let’s look at two other modules that you can leverage to elicit for your new device:
FAQ Module
Requirements often start as an abstraction which can make defining them in concrete terms a challenge. Knowing the right questions to ask helps make requirements more specific and clear.
Modern Requirements4DevOps has templates of over 3,000 predefined questions, including ISO/IEC 15288 (systems engineering standard), ISO 13485 QMS (quality management systems standard) and ISO 14971 (medical devices application of risk management standard), and ISO 26262 & ASPICE (manufacturer product safety standards):
This module is especially useful when defining requirements for user needs and design inputs.
You can also create your own FAQ list and link new questions to existing work items to ensure they are addressed. On the other hand, we can directly create new work items from specific questions. Ideally each of the questions you or your stakeholders create should be covered by corresponding work items.
Email monitor module
Well-structured interviews can be highly effective at collecting requirements from healthcare professionals, patients, as well as sales and marketing teams.
Using Modern Requirements4DevOps email monitor feature, you can invite participants to the design process to join the discussion or even create requirements.
This Email Monitor works by converting emails sent to your configured email address into work items automatically.
Design output – Documentation and reporting
Compiling a design history file, which involves user needs documentation, design input, design planning, and design output throughout the product design lifecycle, can be overwhelming. One thing that can help lighten the load is a centralized documentation tool. In comes Smart Docs.
Smart Docs collates project requirements together in a single document view. Here is an example of a Smart Doc with some requirements, such as user needs as well as system, functional, FMEA risk, and non-functional requirements:
A Smart Doc is a documentation tool as well as a requirement authoring tool which means you can create new work items in the Smart Doc interface. As a comprehensive authoring environment, it allows you to display the rich content of your requirements.
In Smart Docs, you can edit the content in the standard editor of Azure DevOps or using the Modern Requirements Smart Editor – a Word-like editor tool. Images, built-in tables, diagrams, and other rich content can be added and displayed.
Numbers are automatically assigned to indicate hierarchical position of work items and the hierarchical structure can be configured in the meta template designer. So, you’ll have a well-designed document structure for all the different document types.
For design input/output documents you can specify requirement types at each level:
And, for your design verification and validation documents, you can add test cases, for example.
How about changes made to the documents?
In order to pass governance and compliance requirements, two key tasks must take place:
- Changes should be documented
- Changes should be correctly synchronized
Modern Requirements4DevOps captures every change to documents as a revision record. Whenever you make important changes, you can save a new version. This is useful later on to compare changes across versions as well as generate change reports in PDF or Word format.
Common versioning issues are solved by instantly syncing changes everywhere, eliminating manual copy/paste or file transfers.
You can use the Smart Report feature to further configure the format of the report. It allows you to format reports before actually generating them. Default style formats are provided but these are highly customizable, allowing you to pick attributes, change styles, group or sort work items, etc. Here is an example:
In Smart Reports, work items are arranged in rows and their attributes in columns. Reports can be saved in Word, PDF, or HTML format. You can also add your own static content, such as header, footer, or company branding via Word documents or Smart Reports are advanced formatting features.
As you can see, Smart Docs and Smart Reports are built-in documentation and reporting features. Nearly every single design control element contains some activity that needs to be documented. All of this goes into the design history file and can be viewed in a highly organized way using Modern Requirements.
Design Review
During design reviews, you and your project team are formally viewing and agreeing to key deliverables. As part of the review, you need a record to prove all your design controls have been implemented.
Using Modern Requirements4DevOps, you can initiate a review for a single or multiple work items as well as an entire document. Initiators and approvers can directly create or complete review requests, respectively, within the platform without sending extra files through emails.
As a review initiator, you can initiate a review from the dashboard:
There are two types of review events: Request and Approval.
As a review initiator, you can see all the reviews you send out and their status and as an approver you can access the review requests assigned to you:
During a review event, reviewers can add comments for each work item and see and comment on each other’s comments. As an approver, you can add comments and then either approve or reject a single item – or the entire package.
Review initiators can make using an e-signature a requirement for an approver to approve a review request. In this way, you can achieve compliance with 21 CFR part 11.
All history review results can be generated in an audit report in Word or PDF format, documenting every review event in a well-designed audit report format.
Design verification – Traceability analysis
Traceability analysis is a key task during the design verification and validation process. Modern Requirements4DevOps helps you complete this task by enabling you to create updated traceability matrices quickly and easily.
There are two types of traceability matrices:
- Horizontal matrix – provides an end-to-end perspective of the design project.
- Intersection matrix – a two-by-two cross-reference chart between two types of work items.
First, here is an example of a horizontal matrix:
As you can see, User Needs ID 2 breaks down to 1 system and 2 functional requirements and continues surfacing work items all the way through to your test cases.
The FDA asserts that testing requirements should be traceable to individual system requirements and designs. You can document this traceability with one click in a Smart Report or excel format.
For example, you can quickly create a horizontal matrix simply by selecting the requirement type for each level:
Next, we have an intersection matrix. Here is an example that helps to confirm 100% mitigation requirements coverage for FMEA risks:
Another use case is having all the functional requirements on one dimension and all test cases on another dimension to ensure 100% testing coverage. A cross-reference matrix is created simply by choosing a work item type (or sub-type) for each dimension.
Just like other Modern Requirements4DevOps features, updates will be synchronized simultaneously.
Change management
Change management is one of the most important, yet challenging aspects of design control, because changes are inevitable in any project. If we don’t have a foolproof process to establish whether all affected components have been identified over time, changes to the system will reduce its reliability and safety.
We’ve already covered some of Modern Requirements’ capabilities when it comes to change management as part of specific design controls above.
However, as a specific example, when viewing a traceability matrix, you can get an estimation of which downstream requirements will be if changes happen to the upstream requirements.
Let’s look at three more examples:
Baseline
A baseline is a basis for comparison between work items over a period of time. It can be considered a snapshot of requirements at a point of time. Each design project should define a baseline strategy in terms of creation, frequency, content, and documentation. Modern Requirements4DevOps allows you to baseline a single work item or query of work items.
For example, here you can see a comparison of two baselines that show what requirements have been changed, added, or removed:
You can also drill into individual work items to see what exactly changed, when it occurred, and who made it:
As previously mentioned, every time you change a work item, a revision record is created against it. So, you can always compare two revisions to track changes:
A baseline is a vehicle for communicating changes in the detail of requirements to interested stakeholders. Don’t forget to document those changes by generating difference reports or Smart Reports for baseline work items.
Impact Analysis
Let’s say you want to make some changes to a system requirement, for example. You can simply run Modern Requirements’ impact analysis against the system requirement, or any other work item.
That will provide you with a view of all work items that will be directly impacted:
You can then make necessary changes to the impacted work items straight from this view. Or, you can drill down further into individual work items to uncover another layer of impact analysis:
Suspect Link
The idea here is that if someone makes any change to the description of a work item, the linked work item will be flagged as suspect. Your team can then check the associated requirements of the changed item before proceeding to see if any updates are required.
Suspect links are also fully configurable which means you can define precondition criteria, the trigger event, and which work items will be marked as suspect.
Bonus Feature: MatCal
Risk enhancers have associated deciding factors. Let’s say the risk score is associated with the severity score and the occurrence (probability) score. We can use the MatCal feature to automatically calculate the risk score according to the severity and occurrence inputs:
This can replace manual processes, such as calculating the score using Excel spreadsheets and then manually inputting it in the design controls. This helps you avoid the possibility of introducing incorrect numbers to the design project. Once again, these calculations are synced everywhere that this risk is featured.
Custom ID
All work items are uniquely identified using an ID. However, most medical industry clients have thousands of work items in a project or cross multiple projects. This can easily result in long, meaningless IDs. Modern Requirements4DevOps allows you to assign custom, descriptive work item IDs in addition to the default ID generated for work items.
The descriptive ID can quickly give you information, such as the work item type, project origin, etc. and can be automatically assigned by the system based on your configuration.
Conclusion
Microsoft Azure DevOps is a fantastic tool that provides DevOps teams with incredible value across most of the product design lifecycle. However, players in the medical devices industry face a unique roster of challenges, both regulatory and technical.
Modern Requirements4DevOps is developed specifically to help alleviate the pressure on teams through automation, facilitating collaboration, as well as simplifying key tasks, such as defining inputs, documentation, review, traceability, and change management.
The end goal is to not only help you maintain compliance with the highest industry standards, but to also gain a competitive edge, particularly combined with agile practices. All of this in a single tool, without having to rely on a disparate collection of technologies.
Ready to streamline your requirements management?
Start your free 30-day trial of Modern Requirements4DevOps to overcome any and all authoring, designing, documenting, and requirements challenges. Every requirement you create will exist directly within your Azure DevOps project.
You have the option to try it in your own environment for a personalized experience or try it in Modern Requirements’ in-house Azure DevOps Server with pre-built templates.
Please note: If you choose to try it in your own environment, a valid Azure DevOps/VSTS account URL is required.
By submitting this form, you agree to receive emails from Modern Requirements. You understand that you will be subscribed to the Modern Requirements monthly marketing newsletter and periodic offers for additional content and/or services. Your consent can be withdrawn at any time using the links provided in every email.
